> ... Is it a
> problem with Zeek like to much data or was the loss already in the pcap and
> has nothing to do with Zeek?
The loss was already in the pcap. When running on pcaps, Zeek does not
drop any packets present in the pcap.